TTP EXTENSION · VERIFIED #026

Causal Model Completeness Rule

A dependency fingerprint is only as trustworthy as the dependency model that selected its inputs.

A perfect fingerprint can perfectly certify the wrong slice of reality.

Protocol chain

RESOLVE DEPENDENCY CONTRACT M
        ↓
BIND MODEL IDENTITY hash(M)
        ↓
CAPTURE DEPENDENCY VALUES
        ↓
COMPUTE VALUE FINGERPRINT F
        ↓
COMPUTE ARTIFACT D
        ↓
ADOPTION-TIME MODEL CHECK
   ├─ mismatch / unknown → HOLD / REVALIDATE MODEL
   └─ model match        → COMPARE VALUES
                            ├─ mismatch → RECOMPUTE / PROVE
                            └─ match    → eligible to adopt
        ↓
CURRENT AUTHORITY → FENCED COMMIT → PROVE

Invariants

I63 — Correct fingerprint ≠ complete dependency model

Fingerprint correctness proves identity of included values, not completeness of the causal inputs.

I64 — Dependency-set identity is evidence

Preserve the dependency manifest/model identity, version, or digest alongside the artifact.

I65 — Validate the manifest before the values

Adoption should reject an artifact whose declared causal model does not match an authoritative or independently validated dependency contract.

I66 — Unknown causal completeness is a hold condition

Unknown or omitted causal inputs require revalidation, recomputation, domain proof, or escalation before consequence.

Resulting trust record

dependency model identity
+ model validity/completeness evidence
+ dependency value fingerprint
+ current dependency comparison
+ current owner authority
+ fenced commit
+ end-to-end evidence